Analysis
-
max time kernel
121s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2023 12:07
Static task
static1
Behavioral task
behavioral1
Sample
6ef30c9d5d3e48a6f1c9e08b43d22b68.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6ef30c9d5d3e48a6f1c9e08b43d22b68.exe
Resource
win10v2004-20230220-en
General
-
Target
6ef30c9d5d3e48a6f1c9e08b43d22b68.exe
-
Size
677KB
-
MD5
6ef30c9d5d3e48a6f1c9e08b43d22b68
-
SHA1
d6999ce60158f048df94fedcdb01e2b591848fda
-
SHA256
c14a47f25e4a3f032e061a6c9286833c39707fcd05cdcd9cf79903842d069aeb
-
SHA512
d41099602c9659248801e7ef4754292eec0aa382ee09753c3127b8261ff6be701a3016792ca968c73687ba722f571d1bfcdb43e7554e056e3d61a2a0ae5ba6a7
-
SSDEEP
12288:JMrEy90/TI19mPvxD03PMPu42X8gmNe8vwg8IXgePYM4rEpAxtH3:dy/19mPB+MGdUY8vwKgePjVA7X
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4864.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4864.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4864.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4864.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4864.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4864.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4864.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/3580-190-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-193-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-191-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-195-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-197-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-199-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-201-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-203-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-205-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-207-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-209-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-211-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-213-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-215-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-217-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-219-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-221-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline behavioral2/memory/3580-223-0x0000000002990000-0x00000000029CF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
un146947.exepro4864.exequ3258.exesi796279.exepid process 2288 un146947.exe 508 pro4864.exe 3580 qu3258.exe 1420 si796279.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4864.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4864.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4864.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un146947.exe6ef30c9d5d3e48a6f1c9e08b43d22b68.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un146947.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6ef30c9d5d3e48a6f1c9e08b43d22b68.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6ef30c9d5d3e48a6f1c9e08b43d22b68.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un146947.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2136 508 WerFault.exe pro4864.exe 4944 3580 WerFault.exe qu3258.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4864.exequ3258.exesi796279.exepid process 508 pro4864.exe 508 pro4864.exe 3580 qu3258.exe 3580 qu3258.exe 1420 si796279.exe 1420 si796279.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro4864.exequ3258.exesi796279.exedescription pid process Token: SeDebugPrivilege 508 pro4864.exe Token: SeDebugPrivilege 3580 qu3258.exe Token: SeDebugPrivilege 1420 si796279.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6ef30c9d5d3e48a6f1c9e08b43d22b68.exeun146947.exedescription pid process target process PID 1912 wrote to memory of 2288 1912 6ef30c9d5d3e48a6f1c9e08b43d22b68.exe un146947.exe PID 1912 wrote to memory of 2288 1912 6ef30c9d5d3e48a6f1c9e08b43d22b68.exe un146947.exe PID 1912 wrote to memory of 2288 1912 6ef30c9d5d3e48a6f1c9e08b43d22b68.exe un146947.exe PID 2288 wrote to memory of 508 2288 un146947.exe pro4864.exe PID 2288 wrote to memory of 508 2288 un146947.exe pro4864.exe PID 2288 wrote to memory of 508 2288 un146947.exe pro4864.exe PID 2288 wrote to memory of 3580 2288 un146947.exe qu3258.exe PID 2288 wrote to memory of 3580 2288 un146947.exe qu3258.exe PID 2288 wrote to memory of 3580 2288 un146947.exe qu3258.exe PID 1912 wrote to memory of 1420 1912 6ef30c9d5d3e48a6f1c9e08b43d22b68.exe si796279.exe PID 1912 wrote to memory of 1420 1912 6ef30c9d5d3e48a6f1c9e08b43d22b68.exe si796279.exe PID 1912 wrote to memory of 1420 1912 6ef30c9d5d3e48a6f1c9e08b43d22b68.exe si796279.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ef30c9d5d3e48a6f1c9e08b43d22b68.exe"C:\Users\Admin\AppData\Local\Temp\6ef30c9d5d3e48a6f1c9e08b43d22b68.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un146947.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un146947.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4864.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4864.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3258.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3258.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 14724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si796279.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si796279.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 508 -ip 5081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3580 -ip 35801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si796279.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si796279.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un146947.exeFilesize
535KB
MD51c4091bf739ffc8f45f4f8d2dea50f9e
SHA1563a222fc0abdb95d76fa58ef73c351eac4b142a
SHA256fcee28f445d00a3f2810383422131c191b365925bf121f31105ee4280caafda4
SHA51241d179671a255c10a2d28d95af6a57f9b2fecb29498a1843d615d42818068a5d5740701e4eab7c160046e120337bc074877d0158725296648452519e19446b40
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un146947.exeFilesize
535KB
MD51c4091bf739ffc8f45f4f8d2dea50f9e
SHA1563a222fc0abdb95d76fa58ef73c351eac4b142a
SHA256fcee28f445d00a3f2810383422131c191b365925bf121f31105ee4280caafda4
SHA51241d179671a255c10a2d28d95af6a57f9b2fecb29498a1843d615d42818068a5d5740701e4eab7c160046e120337bc074877d0158725296648452519e19446b40
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4864.exeFilesize
311KB
MD56ea096b2afc0743328e9d132523aa017
SHA1c8bd35e64d8082439deb43730ae8dc6180df7866
SHA2564b04ea79ed8341860e5e8b7fefdff4368ff78d02bb21d405c2f6654026c38458
SHA512d794061490d4668ab0bf3c30d2aa6647e778d76ef987d701c89e04a7b311f2c4a846ecf013cae133585d9d317ff49a88624eb8b5a328ffa920621a83a1c82f02
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4864.exeFilesize
311KB
MD56ea096b2afc0743328e9d132523aa017
SHA1c8bd35e64d8082439deb43730ae8dc6180df7866
SHA2564b04ea79ed8341860e5e8b7fefdff4368ff78d02bb21d405c2f6654026c38458
SHA512d794061490d4668ab0bf3c30d2aa6647e778d76ef987d701c89e04a7b311f2c4a846ecf013cae133585d9d317ff49a88624eb8b5a328ffa920621a83a1c82f02
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3258.exeFilesize
370KB
MD537bc4f4e47510d44307cfba07533b169
SHA1fcb43d0c63bef50af1a941b68fd8edf77d0e1f8e
SHA256a8f031b823d6c135cd9f179fee7c6954183f6a5e95e9c2bcc15a774ea2910e64
SHA512000487d3a767b2949c79bbab10c6a1876eb3ae8919c6e76cd2e649558f68f5305d4144912f36d91d1bf93560aa1be83806d4b95fe04eebe21324ccd427e2f06d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3258.exeFilesize
370KB
MD537bc4f4e47510d44307cfba07533b169
SHA1fcb43d0c63bef50af1a941b68fd8edf77d0e1f8e
SHA256a8f031b823d6c135cd9f179fee7c6954183f6a5e95e9c2bcc15a774ea2910e64
SHA512000487d3a767b2949c79bbab10c6a1876eb3ae8919c6e76cd2e649558f68f5305d4144912f36d91d1bf93560aa1be83806d4b95fe04eebe21324ccd427e2f06d
-
memory/508-148-0x0000000000830000-0x000000000085D000-memory.dmpFilesize
180KB
-
memory/508-149-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/508-150-0x0000000004FD0000-0x0000000005574000-memory.dmpFilesize
5.6MB
-
memory/508-151-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-152-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-154-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-156-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-158-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-160-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-162-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-164-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-166-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-168-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-170-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-172-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-174-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-176-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-178-0x0000000004EB0000-0x0000000004EC2000-memory.dmpFilesize
72KB
-
memory/508-179-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/508-180-0x0000000000400000-0x0000000000802000-memory.dmpFilesize
4.0MB
-
memory/508-181-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/508-182-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/508-184-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/508-185-0x0000000000400000-0x0000000000802000-memory.dmpFilesize
4.0MB
-
memory/1420-1120-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/1420-1119-0x0000000000550000-0x0000000000582000-memory.dmpFilesize
200KB
-
memory/3580-191-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-373-0x0000000002310000-0x0000000002320000-memory.dmpFilesize
64KB
-
memory/3580-197-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-199-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-201-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-203-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-205-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-207-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-209-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-211-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-213-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-215-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-217-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-219-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-221-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-223-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-371-0x0000000000820000-0x000000000086B000-memory.dmpFilesize
300KB
-
memory/3580-195-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-375-0x0000000002310000-0x0000000002320000-memory.dmpFilesize
64KB
-
memory/3580-1099-0x00000000055C0000-0x0000000005BD8000-memory.dmpFilesize
6.1MB
-
memory/3580-1100-0x0000000005C00000-0x0000000005D0A000-memory.dmpFilesize
1.0MB
-
memory/3580-1101-0x0000000005D40000-0x0000000005D52000-memory.dmpFilesize
72KB
-
memory/3580-1102-0x0000000005DA0000-0x0000000005DDC000-memory.dmpFilesize
240KB
-
memory/3580-1103-0x0000000002310000-0x0000000002320000-memory.dmpFilesize
64KB
-
memory/3580-1104-0x0000000006050000-0x00000000060E2000-memory.dmpFilesize
584KB
-
memory/3580-1105-0x00000000060F0000-0x0000000006156000-memory.dmpFilesize
408KB
-
memory/3580-1107-0x0000000002310000-0x0000000002320000-memory.dmpFilesize
64KB
-
memory/3580-1108-0x0000000002310000-0x0000000002320000-memory.dmpFilesize
64KB
-
memory/3580-1109-0x0000000006810000-0x0000000006886000-memory.dmpFilesize
472KB
-
memory/3580-1110-0x00000000068A0000-0x00000000068F0000-memory.dmpFilesize
320KB
-
memory/3580-1111-0x0000000002310000-0x0000000002320000-memory.dmpFilesize
64KB
-
memory/3580-193-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-190-0x0000000002990000-0x00000000029CF000-memory.dmpFilesize
252KB
-
memory/3580-1112-0x0000000006A30000-0x0000000006BF2000-memory.dmpFilesize
1.8MB
-
memory/3580-1113-0x0000000006C00000-0x000000000712C000-memory.dmpFilesize
5.2MB